skills.rest
josemlopez
josemlopezCOMMUNITY
Explore all skills by this author →
GitHub

tm-verify

Scan codebases for missing security controls and generate structured evidence reports.

8|1|Updated Jan 20, 2026
Search Tags:#codebase#compliance#evidence#grep#verify#threat-model#security-controls
One-click install
npx skills add https://github.com/josemlopez/threat-modeling-toolkit --skill tm-verify
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: tm-verify
Source: https://github.com/josemlopez/threat-modeling-toolkit/tree/main/skills/tm-verify
Command: npx skills add https://github.com/josemlopez/threat-modeling-toolkit --skill tm-verify

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps teams ensure that security controls documented in threat models are actually implemented in the codebase, aligning design with deployment.

Core Features & Use Cases

  • Control discovery: Scan repositories for evidence of authentication, authorization, input validation, and other security controls.
  • Evidence gathering: Collect file paths, configurations, and middleware evidence to support audits.
  • Remediation planning: Highlight gaps (missing or partial controls) and suggest concrete remediation steps.

Quick Start

Use the tm-verify command to check a specific control or verify all controls against the threat model. Example: /tm-verify --control rate-limiting or /tm-verify --thorough --evidence.

Frequently Asked Questions about tm-verify

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I verify threat model security controls are actually implemented in a codebase?▼

Verify security controls by scanning the codebase for implementation patterns using grep. The tool applies per-control patterns to identify missing or misconfigured controls and collates evidence with file paths and line references.

How can I check if authentication and authorization middleware is properly configured?▼

Check authentication and authorization middleware by applying per-control patterns to relevant code paths and configurations. The tool collects evidence and produces a structured report detailing implemented, partial, and missing controls.

What is the best way to gather compliance evidence for security audits from source code?▼

Gather compliance evidence by scanning repositories for security controls like input validation. The tool collates file paths, configurations, and middleware evidence to support audits and produce a structured report.

Can I scan for a specific security control like rate-limiting in my repository?▼

Scan for a specific security control like rate-limiting by passing the control name as an argument. The tool applies targeted patterns to relevant code paths and reports whether the control is implemented, partial, or missing.

Does this codebase security verification tool require any external dependencies?▼

No external dependencies are required to run this codebase security verification tool. It operates independently to scan repositories, apply per-control patterns, and generate structured compliance reports.

How do I identify missing security controls and plan remediation steps?▼

Identify missing security controls by scanning the codebase against threat model patterns. The tool highlights gaps in implemented, partial, and missing controls, and suggests concrete remediation steps in a structured report.

Related Skills

Explore More Software Engineering Skills→
jlawsjlaws
2

cmd-security-audit

Run STRIDE threat modeling and SAST vulnerability scans on codebases.

Community
Advanced
aanishsaanishs
10

comply-fix

Identify and remediate failed HIPAA/NIST controls with automated patches and re-scans.

Community
Advanced
eliottbusinesseliottbusiness

requesting-code-review

Automate pre-commit code review with static analysis and security scanning.

Community
Advanced
williamzujkowskiwilliamzujkowski
17

nist

Map systems to NIST controls and generate implementation plans.

Community
Advanced